{"id":"c80bc9b2-cd19-49a4-8645-ec3cf3c77f91","arxiv_id":"2608.11691","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":10,"one_line_summary":"An inference-time unlearning method uses token entropy to detect when RL-trained multimodal reasoning models are about to recite private facts in their chain of thought, then redirects decoding with a visual anchor.","lead":"RL-trained multimodal reasoning models can recite a privacy-sensitive fact inside their chain of thought even after the fact is cleaned from the final answer, and that leakage has a detectable token-entropy signature. This paper introduces LEMUR, an inference-time unlearning method that uses that entropy signal to switch decoding away from the sensitive span and redirect it with a visual anchor, without retraining.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The benchmark cannot support the privacy-leakage claim: the target vanilla checkpoints never learned the fictitious MLLMU-Bench facts, so the reported 'leakage' may be hallucination rather than RL-memorized recall.","rationale":"The reader's weakest assumption is correct, and the full text contains an even sharper internal tension: the appendix calls the distilled chains 'the supervision target on which the RL-trained MLRM is built,' while the main text says LEMUR is 'applied to the vanilla checkpoint.' No RL-training step on MLLMU-Bench is described anywhere. Without such a step, the target model cannot have memorized the fictitious subjects' private attributes, so the observed high SRL and the entropy signature are not evidence of RL-induced private-knowledge recall. The qualitative transcripts reinforce this: LEMUR replaces pet rabbit with cat, Wellington with Toronto, and Environmental Engineer with geologist, which is the behavior of a model fabricating plausible content, not a model suppressing a known fact. If the text-only probe I propose shows near-chance recall, the central claim collapses to a weaker statement about suppressing hallucinated sensitive attributes, which may be useful but is not the claimed privacy risk. I therefore recommend moving from CONDITIONAL to REJECT for the current version, conditional on the authors either demonstrating genuine memorized leakage on subjects the model actually knows or reframing the contribution and evaluation accordingly. The paper does earn credit for a clean, training-free decoding intervention with component ablations and multiple backbones, but those strengths do not repair the gap between the evidence and the central claim.","tokens_in":22127,"tokens_out":10191,"duration_ms":116513,"concrete_test":"Run the vanilla checkpoint from Table 1 on each MLLMU-Bench forget-split question with the portrait image replaced by a fixed neutral vision embedding (no image information), and compute the rate at which the curated private attributes appear in the generated reasoning trace. Also run the same text-only probe with a second set of randomly swapped attribute labels as the gold set. If text-only attribute-recall is at or near the swapped-label baseline, the model has no memorized representation of the fictitious subjects' facts, and the reported leakage/entropy phenomena cannot be attributed to RL memorization.","verdict_should_be":"REJECT","load_bearing_attack":"The central claim is that RL-trained MLRMs leak sensitive facts they have memorized, in the reasoning trace, and that the rise-then-collapse entropy signature is a signature of that memorized recall. The experiments, however, do not show that the target model ever memorized the forget-set facts. MLLMU-Bench subjects are fictitious (appendix 'Reasoning-Chain Distillation'), and the target backbones are used as 'vanilla checkpoint[s]' (Experiments). The teacher-distilled chains are produced after the fact and are not part of the model's RL training; the appendix's statement that the distilled chain 'becomes the supervision target on which the RL-trained MLRM is built' is not backed by any described RL-training step and appears to conflict with the main text. Since a vanilla checkpoint cannot contain the private attributes of fictional identities, any occurrence of a curated attribute in the CoT is either read from the portrait (unverified and implausible for birthplace/pet name) or confabulated. The qualitative transcripts support this: after LEMUR, the model emits plausible wrong attributes (cat, Toronto, geologist) and explicitly narrates 'I recall' over fabricated details. Consequently, vanilla SRL of 57-62% and the entropy signature may characterize hallucination or generic CoT generation, not the RL-induced recall of private knowledge that the abstract asserts. The central privacy phenomenon is therefore not established by this benchmark.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper claims that reinforcement-learning-trained multimodal large reasoning models (MLRMs) can leak sensitive facts in the chain-of-thought even when the final answer is clean, that this leakage produces a distinctive rise-then-collapse token-level entropy signature, and that LEMUR—a fully training-free, inference-time unlearning method—can suppress both reasoning-trace and answer leakage by switching into a latent decoding mode with entropy-controlled visual-anchor injection. The method is evaluated on a reconstructed MLLMU-Bench corpus with distilled reasoning chains, using R1-Onevision-7B, Vision-R1-7B, OpenVLThinker-7B, and Qwen2.5-VL as backbones, and is reported to outperform training-based and training-free baselines on leakage suppression while preserving utility and fluency.","tokens_in":22515,"tokens_out":7814,"duration_ms":79419,"significance":"If the central phenomenon were established, the paper would address a genuinely important gap: existing unlearning methods target final answers and largely ignore reasoning traces, despite the growing deployment of RL-trained reasoning models. The proposed method is explicit and mechanistically grounded in decoding-time control, and the paper includes useful ablations, multiple backbones, and forget-ratio robustness checks. I also credit the paper for formalizing subject-level unlearning for reasoning traces in Eq. (2) and for providing full qualitative transcripts. However, the significance is conditional: the evaluation does not actually demonstrate that the target models memorized the fictitious private attributes it tries to remove, so the reported leakage and entropy signature may be properties of hallucination rather than of RL-induced memorized recall.","major_comments":[{"comment":"The central claim—that RL-trained MLRMs leak memorized private facts in the reasoning trace with a distinctive entropy signature—is not supported by the evaluation. In §Experiments the authors state that LEMUR is 'applied to the vanilla checkpoint,' and the appendix describes distilling reasoning chains with Qwen3.5-35B-A3B and storing them as Reasoning_Target metadata, but no RL training or fine-tuning step is described that would cause the vanilla R1-Onevision-7B, Vision-R1-7B, or OpenVLThinker-7B checkpoints to memorize the fictitious MLLMU-Bench attributes. Since the subjects are fictitious, a vanilla checkpoint cannot contain their private attributes; the 57–62% vanilla SRL values in Table 1 and the entropy signature of Fig. 2 may therefore characterize confabulation or generic chain-of-thought generation rather than RL-induced recall. The qualitative transcripts (Listings 3–5) corroborate this concern: the unlearned model identifies subject 409 as 'Oliver Hargrove' although the curated identity is Ericson Hyland, and it fabricates attributes such as 'a cat named Whiskers.' To sustain the privacy claim, the authors should either RL-train (or otherwise fine-tune) models on the distilled chains so the attributes are genuinely memorized, or build the benchmark from facts known to be in the model's training data; otherwise the claims must be reduced to the materially weaker statement that LEMUR suppresses hallucinated private-looking content.","section":"§Experiments, Benchmark and models; §Appendix, Reasoning-Chain Distillation"},{"comment":"There is an internal contradiction about the role of the distilled chains. The appendix states that the distilled chain 'becomes the supervision target on which the RL-trained MLRM is built and against which LEMUR performs inference-time unlearning,' but the Experiments section specifies that the backbones are used as vanilla checkpoints, and the VQAv2 transfer experiment explicitly 'reuse[s] the original RL-trained MLRM weights without any modification.' No RL-training run or checkpoint incorporating Reasoning_Target is described anywhere. This contradiction is load-bearing because it determines whether the evaluation tests the stated phenomenon at all; it must be resolved with a concrete description of how, if at all, the target models were conditioned on the distilled chains.","section":"§Appendix, Training-Data Construction; §Experiments"},{"comment":"All numerical results are reported as single point estimates, without standard deviations, number of runs, seeds, or significance tests. On a finite fictitious-subject benchmark, SRL and accuracy are sensitive to the particular subjects assigned to the forget split, so the claim that LEMUR 'consistently' outperforms baselines across backbones and forget ratios is not statistically supported. The authors should report mean and standard deviation over at least several seeds and, where appropriate, a paired significance test (e.g., bootstrap or Wilcoxon) on SRL and target recall.","section":"Tables 1, 2, 3, 5, 6"},{"comment":"The method has ten hyperparameters—rho, rho_lo, tau, gamma, gamma_max, beta, eta, kappa, W_max, and C—but none of their values are reported in the main text or the appendix, nor is the construction of the forbidden-token set Phi_s or the exact string-matching protocol for SRL specified. The statement that OpenVLThinker results are obtained 'without any re-tuning' is not verifiable without these values and a sensitivity analysis. Without this information, the method is not reproducible and the claimed cross-backbone generality is not assessable.","section":"§Method, Eqs. (5), (9), (11), (12), (13); §Experiments"}],"minor_comments":[{"comment":"The backbone is referred to as 'R1-Onevision-7B' in the text and 'Onevision-R1-7B' in Table 1 and several other places; the naming should be made consistent.","section":"Throughout"},{"comment":"The last ablation row is labeled '+DPED' in the table but '+DEPD' in the text and elsewhere; the typo should be corrected.","section":"Table 3"},{"comment":"Eq. (7) describes the expected embedding as 'gradient-preserving'; since LEMUR operates purely at inference time with no gradient computation, this phrase is misleading, and 'continuous' or 'soft' would be more accurate.","section":"§Method, Eq. (7)"},{"comment":"Eq. (10) calls the combination of e_hat_t and the anchor a convex interpolation, which requires gamma_t in [0,1]; the cap gamma_max in Eq. (11) should be explicitly constrained to satisfy gamma_max <= 1, or the interpolation formula should be adjusted accordingly.","section":"§Method, Eqs. (10)–(11)"},{"comment":"The appendix says the gold answer never appears verbatim in the context, but Listing 2 includes 'Correct answer: {answer}' in the user prompt; the claim should be clarified to refer only to the attribution-context list, not the user prompt as a whole.","section":"§Appendix, Anti-leakage attribution context"},{"comment":"The RRA metric is described only as the judgment of Gemini-2.5-Pro; the exact prompt, the number of judged samples, and any reliability or agreement check should be reported.","section":"§Experiments, Metrics"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. The entropy-signature idea is genuinely novel: using token-level entropy dynamics to decide when to intervene during decoding is clever, and the method is spelled out carefully. But the benchmark cannot support the paper's central privacy claim, because the target models are vanilla checkpoints that never encountered the fictitious MLLMU-Bench subjects. The model has no way to have memorized those attributes. The reported vanilla leakage of 57–62% SRL is either read off the portrait (implausible for a birthplace or pet name) or simply confabulated. The qualitative transcripts show exactly that: after LEMUR, the model confidently 'recalls' a cat named Whiskers, Toronto, a geologist, and so on. So the phenomenon the paper claims to address—RL-trained models leaking facts they actually memorized—is not demonstrated.\n\nWhat the paper does well: the method itself is clearly specified. The entropy-augmented sensitivity switch, the latent feedback with forbidden-mass removal, the entropy-modulated visual anchor injection, and the adaptive phase duration are all sensible, and the ablation shows each component contributes. The comparison against R-MUSE is fair, and the transfer experiment to Qwen2.5-VL is a nice touch. The writing is generally good.\n\nThe soft spots are proportionate. Missing error bars, significance tests, and hyperparameters are addressable in revision. The benchmark issue is not. The appendix statement that the distilled chain 'becomes the supervision target on which the RL-trained MLRM is built' directly conflicts with the main text, which says the method is applied to the vanilla checkpoint; there is no RL-training step anywhere. The VQAv2 generalization experiment uses the same distilled-chain setup, so it inherits the circularity. The method might work as a generic suppressor of sensitive-attribute generation, but the privacy framing is unsupported.\n\nWho is this for? Researchers working on inference-time unlearning or reasoning-model interpretability. The entropy-control idea is worth a look. But the paper needs major revision: either actually RL-train models on the distilled chains and show memorization, or reframe the claims around confabulation suppression and validate on real-world identities the model genuinely knows. I would send it to peer review because the idea deserves a careful look, but I would not accept it in this form.\n\nRecommendation: reject with clear guidance for resubmission, or conditional accept if the authors can redo the benchmark. As it stands, the central claim is not established.","headline":"Clever entropy-gated decoding method, but the benchmark never shows the model actually memorized the 'private' facts, so the central privacy claim is unproven.","tokens_in":23000,"tokens_out":4242,"would_cite":false,"duration_ms":41162,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper argues that RL-trained multimodal reasoning models can recite a supposedly unlearned private fact inside their chain of thought, and introduces LEMUR, a training-free inference-time framework that uses a two-stage token-level…","keywords":["machine unlearning","multimodal large reasoning models","chain-of-thought privacy leakage","token-level entropy","inference-time unlearning","visual anchor latent injection","entropy-augmented decoding","training-free unlearning"],"falsifier":"Train or fine-tune a small multimodal reasoning model on a known set of private facts about synthetic subjects, then check whether recalling those facts produces the reported rise-then-collapse token-entropy signature. If genuinely learned facts show no such signature, or if LEMUR only swaps correct attributes for confabulated ones on subjects it never memorized, the central privacy mechanism is not demonstrated. A second check is whether leakage persists when the same private attribute is paraphrased or phrased in another language, avoiding the forbidden token set.","tokens_in":21898,"feed_emoji":"🧠","tokens_out":7655,"duration_ms":66283,"temperature":0.7,"pith_summary":"Reinforcement-learning post-training makes multimodal models reason out loud, and this paper argues that the same exploration opens a privacy hole: a sensitive fact that has been removed from the final answer can still be recited inside the chain of thought. The paper claims this leakage carries a two-stage token-level entropy signature—high entropy while candidate values compete, then a collapse to near-certainty as the memorized span is recited—that is largely absent from non-reasoning base models. LEMUR exploits that signal to perform unlearning entirely at decoding time, without weight updates: it detects the sensitive span, switches from discrete sampling to a latent decoding regime, and injects an entropy-modulated visual anchor that regrounds the trajectory in the image. Across three RL-trained multimodal reasoning backbones, LEMUR lowers subject-level reasoning leakage well below existing unlearning baselines while keeping non-sensitive accuracy and fluency close to the vanilla model.","feed_headline":"Entropy spikes reveal where reasoning models leak private facts","feed_subtitle":"LEMUR reads token-level uncertainty and redirects the chain of thought before the secret is spoken.","key_machinery":"The central object is the two-stage token-level entropy signature of memorized recall, computed as $H_t(v)=-\\sum_{v\\in\\mathcal{V}} p_t(v)\\log p_t(v)$, combined with a forbidden-token set $\\Phi_s$. The mechanism is a decoding-time mode switch: in ordinary discrete mode the model samples normally; the gate $g_t$ fires when forbidden probability mass crosses $\\rho$ (lexical, committed recital) or when entropy exceeds $\\tau$ with a smaller forbidden-mass threshold $\\rho_{lo}$ (deliberation); in sensitive mode, instead of feeding back the sampled one-hot token, LEMUR feeds the expected embedding of the restricted distribution $\\tilde{p}_t$ (forbidden tokens removed and renormalized), interpolated with a composite visual and safe-answer anchor $a=\\beta e_{vis}+(1-\\beta)e_{safe}$ at strength $\\gamma_t\\propto H_t(v)/\\tau$, and ends the phase when entropy recovers above $\\kappa\\bar{H}_t$ or a maximum window $W_{max}$ elapses. This machinery lets the model remain unmodified while the reasoning trajectory is redirected away from the memorized attribute and toward image-grounded, non-sensitive content.","core_discovery":"The central claim is that RL-trained multimodal large reasoning models leak protected attributes in the reasoning trace even when the final answer is clean, that this leak is marked by a two-stage entropy pattern—per-token entropy rising as the model deliberates among candidate values, then collapsing once it commits to the memorized span—and that decoding-time intervention can exploit that pattern to erase the fact on the fly. LEMUR keeps the original weights, identifies the sensitive segment with a lexical forbidden-token mass test augmented by an entropy cue, and inside that segment feeds back a continuous embedding rather than a sampled token: forbidden mass is removed by renormalization, and the latent state is steered by a convex blend of a visual anchor and a safe-answer anchor whose injection strength is proportional to step entropy. The phase is released when entropy recovers above an adaptive threshold, with a cooldown to prevent oscillations. The paper reports that this removes both answer-level and trace-level leakage on R1-Onevision-7B, Vision-R1-7B, and OpenVLThinker-7B while preserving retain- and celebrity-split utility.","pith_inferences":["The authors leave implicit that the entropy tripwire depends on the model concentrating probability mass on forbidden tokens; if an attacker paraphrases the private fact or asks in another language, the lexical branch may not fire, and the paper's experiments do not establish how much leakage survives such paraphrasing.","The reported forgetting often replaces the true attribute with a plausible but wrong value drawn from the model's prior. A testable consequence is that a post-LEMUR model does not refuse; it confabulates, so downstream factuality judges should expect hallucinations on forgotten subjects rather than silence.","A neighboring problem this suggests is that if RL exploration leaves entropy signatures for other memorized content, the same decoder-side gate could be repurposed to detect hallucinations, sycophancy, or jailbroken reasoning before the model commits to a span.","One could test the central claim more directly by training a model on known private facts and checking whether recalling those facts produces the same rise-then-collapse entropy signature; if genuinely learned facts show no such signature, the reported phenomenon may be an artifact of teacher-distilled chains."],"forward_implications":["If LEMUR works as reported, machine unlearning for reasoning models no longer requires retraining or activation steering: the same vanilla RL-trained checkpoint can be sanitized at serve time for a given forget set.","Answer-level unlearning metrics are insufficient for RL-trained reasoning models; deployment of such models should also measure subject-level reasoning leakage inside the chain of thought.","The entropy signature transfers across backbones: the paper reports that LEMUR remains effective on a non-RL Qwen2.5-VL and on a general visual-reasoning corpus (VQAv2), suggesting the phenomenon is tied to RL post-training rather than to specific private-attribute content.","Because LEMUR leaves weights untouched, it can be layered on top of any existing training-based unlearning result, potentially combining global erasure with local decode-time sanitization."],"supporting_citations":[{"why":"Supplies MLLMU-Bench, the fictitious-subject corpus with portrait images and private QA pairs that the experiments reconstruct into reason-chain form.","marker":"(Liu et al. 2025a)"},{"why":"Provides R1-Onevision-7B, one of the two primary RL-trained multimodal reasoning backbones evaluated.","marker":"(Yang et al. 2025)"},{"why":"Provides Vision-R1-7B, the second primary RL-trained reasoning backbone evaluated.","marker":"(Huang et al. 2025)"},{"why":"Formalizes reasoning-preserving unlearning via R-MUSE, the closest training-free baseline against which LEMUR is compared.","marker":"(Li et al. 2026)"},{"why":"Shows that perturbing reasoning traces aggressively causes degenerate repetition, motivating LEMUR's decode-time rather than activation-level intervention.","marker":"(Wang et al. 2025)"},{"why":"Introduces the RL-with-verifiable-rewards reasoning paradigm that the multimodal reasoning models inherit.","marker":"(Guo et al. 2025)"},{"why":"Provides Qwen2-VL, the instruct MLLM family on which the RL-trained reasoning backbones are built.","marker":"(Wang et al. 2024)"}],"fun_headline_variants":["Entropy cue catches private facts in reasoning traces","Training-free unlearning: redirect CoT before the leak","RL reasoning leaks secrets; entropy exposes the leak","LEMUR: halt the thought, erase the fact, keep the model","Read the entropy, stop the leak: LEMUR's twist"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The experiments measure leakage against facts in reasoning chains that a teacher model wrote for each image, while the unlearned models were ordinary checkpoints that never trained on those chains, so the reported forgetting could be suppressing attributes the model is inventing from the picture rather than private facts it genuinely memorized.","fun_headline_variants_meta":{"raw":{"variants":["Entropy cue catches private facts in reasoning traces","Training-free unlearning: redirect CoT before the leak","RL reasoning leaks secrets; entropy exposes the leak","LEMUR: halt the thought, erase the fact, keep the model","Read the entropy, stop the leak: LEMUR's twist"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000826,"raw_usage":{"total_tokens":3658,"prompt_tokens":1042,"completion_tokens":2616,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":658,"completion_tokens_details":{"reasoning_tokens":2533}},"tokens_in":658,"tokens_out":2616,"duration_ms":21215,"temperature":1.0,"reasoning_tokens":2533,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T00:30:35.701855+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train or fine-tune a small multimodal reasoning model on a known set of private facts about synthetic subjects, then check whether recalling those facts produces the reported rise-then-collapse token-entropy signature. If genuinely learned facts show no such signature, or if LEMUR only swaps correct attributes for confabulated ones on subjects it never memorized, the central privacy mechanism is not demonstrated. A second check is whether leakage persists when the same private attribute is paraphrased or phrased in another language, avoiding the forbidden token set.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides R1-Onevision-7B, one of the two primary RL-trained multimodal reasoning backbones evaluated."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Shows that perturbing reasoning traces aggressively causes degenerate repetition, motivating LEMUR's decode-time rather than activation-level intervention."}],"review_version":1}